Cloud Hosting

Dive Brief:

SLP was originally developed in 1997 as a mechanism for systems on a network to communicate with each other. However, researchers say SLP was never designed to be exposed to the public internet.

VMware has disabled SLP by default since 2021 after issuing prior warnings about vulnerabilities in ESXi products. The company warned customers in February to apply security updates and disable OpenSLP after a series of ransomware attacks.

Researchers warn such an attack using this vulnerability could result in one of the most powerful DoS attacks ever committed.

This flaw is easily exploitable and should be considered particularly dangerous to the global community given the large-scale amplification that can be achieved, Pedro Umbelino, principal security researcher at BitSight, said via email.

VMware said in a blog post that earlier unsupported releases of ESXi, have been shown to be affected by the vulnerability.

As noted by the researchers, many SLP services visible to the internet appear to be older and likely abandoned services, a spokesperson said via email.

Currently supported services, including ESXi 7.x and 8.x lines are not impacted by the amplification attack, according to VMware.

View post:
More than 2K organizations at risk of major attacks linked to SLP ... - Cybersecurity Dive